{"id":"CVE-2026-126481","kind":"vulnerability","aliases":["CVE-2026-126481"],"related":[],"title":"OpenEMR: path traversal in ERA upload lets billing users write files","description":"OpenEMR before 8.5.0 contains a path traversal vulnerability in era_payments.php and sl_eob_search.php that allows authenticated billing users to write files outside the ERA directory. Attackers can embed traversal sequences in the GS04 element of an uploaded X12 835 file to overwrite .edi or .835 files with attacker-controlled content anywhere writable by the web server.","summary":"OpenEMR before 8.5.0 has a path traversal flaw in era_payments.php and sl_eob_search.php. An authenticated billing user can embed traversal sequences in an uploaded X12 835 file to write attacker-controlled content to any location the web server can write to.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","package","php"],"not_affected_if":["no-billing-users","version-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version in the installation; versions before `8.5.0` are affected.","fix":"- Move OpenEMR to `8.5.0` or later.","status":"open","published_at":"2026-11-13T10:17:57+00:00","first_seen_at":"2026-11-13T10:47:26+00:00","triaged_at":"2026-11-13T10:52:24+00:00","updated_at":"2026-11-13T10:52:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:52:24Z","model":"claude-haiku-5-5","output":{"fix":"- Move OpenEMR to `8.5.0` or later.","reach":"network","title":"OpenEMR: path traversal in ERA upload lets billing users write files","impact":"high","summary":"OpenEMR before 8.5.0 has a path traversal flaw in era_payments.php and sl_eob_search.php. An authenticated billing user can embed traversal sequences in an uploaded X12 835 file to write attacker-controlled content to any location the web server can write to.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openemr","healthcare","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker overwrites arbitrary writable files on the server, possibly reaching code execution","analyst_note":"","how_to_check":"- Check the OpenEMR version in the installation; versions before `8.5.0` are affected.\n- unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-8.5.0-or-later","no-billing-users"],"who_is_affected":"OpenEMR installations before 8.5.0 where users with billing access can upload ERA (X12 835) files. Exposure depends on the web server having write access to locations beyond the ERA directory. Installations on 8.5.0 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000707,"input_tokens":4631,"output_tokens":488,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126481':14A,17A '-2026':13A,16A '8.5.0':24B,64C '835':46B,99C,105C 'allow':75C 'anywher':112C 'attack':51B,86C,109C 'attacker-control':50B,108C 'authent':35B,76C 'bill':8A,36B,77C 'contain':65C 'content':53B,111C 'control':52B,110C 'cve':12A,15A 'directori':85C 'edi':103C 'element':94C 'emb':39B,88C 'era':5A,84C 'era_payments.php':31B,71C 'file':11A,47B,81C,100C,106C 'flaw':29B 'gs04':93C 'healthcar':18B 'let':7A 'locat':56B 'openemr':1A,19B,22B,62C 'outsid':82C 'overwrit':102C 'packag':20B 'path':2A,27B,67C 'php':21B 'sequenc':41B,90C 'server':59B,117C 'sl_eob_search.php':33B,73C 'travers':3A,28B,40B,68C,89C 'upload':6A,44B,97C 'user':9A,37B,78C 'vulner':69C 'web':58B,116C 'writabl':113C 'write':10A,49B,61B,80C 'x12':45B,98C","nicknames":[],"mitigations":[],"who_affected":"OpenEMR installations before 8.5.0 where users with billing access can upload ERA (X12 835) files. Exposure depends on the web server having write access to locations beyond the ERA directory. Installations on 8.5.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","package","php"],"campaign_type":null,"search_a":"'-126481':14A,17A '-2026':13A,16A 'bill':8A 'cve':12A,15A 'era':5A 'file':11A 'let':7A 'openemr':1A 'path':2A 'travers':3A 'upload':6A 'user':9A 'write':10A","search_b":"'8.5.0':24B '835':46B 'attack':51B 'attacker-control':50B 'authent':35B 'bill':36B 'content':53B 'control':52B 'emb':39B 'era_payments.php':31B 'file':47B 'flaw':29B 'healthcar':18B 'locat':56B 'openemr':19B,22B 'packag':20B 'path':27B 'php':21B 'sequenc':41B 'server':59B 'sl_eob_search.php':33B 'travers':28B,40B 'upload':44B 'user':37B 'web':58B 'write':49B,61B 'x12':45B","search_c":"'8.5.0':64C '835':99C,105C 'allow':75C 'anywher':112C 'attack':86C,109C 'attacker-control':108C 'authent':76C 'bill':77C 'contain':65C 'content':111C 'control':110C 'directori':85C 'edi':103C 'element':94C 'emb':88C 'era':84C 'era_payments.php':71C 'file':81C,100C,106C 'gs04':93C 'openemr':62C 'outsid':82C 'overwrit':102C 'path':67C 'sequenc':90C 'server':117C 'sl_eob_search.php':73C 'travers':68C,89C 'upload':97C 'user':78C 'vulner':69C 'web':116C 'writabl':113C 'write':80C 'x12':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:38:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126481","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126481","severity":null,"published_at":"2026-11-13T10:17:57+00:00","modified_at":"2026-11-13T10:17:58+00:00","first_seen_at":"2026-11-13T10:47:26+00:00","fetched_at":"2026-11-13T10:47:26+00:00","note":null}],"documents":[{"id":145205,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-mf55-7h68-r2rp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:38:45+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145206,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-path-traversal-via-era-835-file-upload","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}